+SYS.1.6.A24 Host-Based Attack Detection (H)

SYS.1.6.A24 Host-Based Attack Detection (H)

The behaviour of containers and the applications or services running in them SHOULD be monitored. Deviations from normal behaviour SHOULD be noticed and reported. The reports SHOULD be handled appropriately in a centralised process for security incident handling.

At minimum, the behaviour to be monitored SHOULD cover:

  • Network connections
  • Created processes
  • File system access attempts
  • Kernel requests (syscalls)

1. Vue d’ensemble

1.1 Références

1.2 Exigences identifiées

1.3 Réglementations associées

2. Exigences identifiées

Exigences

3. Réglementations associées

Réglementations

Tickets liés

Liens
blocks G 0.22 Manipulation of Information
blocks G 0.28 Software Vulnerabilities or Errors
blocks G 0.39 Malware
blocks G 0.46 Loss of Integrity of Sensitive Information